testnet[.]humanitiy[.]xyz

The domain testnet.humanitiy.xyz was registered on February 21, 2026 and is currently taken offline. Authority records show the name server configuration points to Cloudflare infrastructure; the domain resolves to IP address 172.67.206.84, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The HTTPS certificate presented is identified as WE1, indicating a standard Cloudflare‑issued TLS certificate without further validation. The site title returned from the HTTP host is "Login | Humanity Protocol," which aligns with the reported scam type of wallet/seed phishing and the brand impersonation of the across ecosystem.

VirusTotal analysis flags the domain on three of ninety‑three scanned security vendors, and the domain appears on two independent blocklists, PhishDestroy and ScamSniffer. Reputation services assign extremely low confidence scores: Gridinsoft rates it 0 out of 100 and Scamadviser 1 out of 100. No additional public intelligence such as OTX references or Safe Browsing alerts is referenced in the supplied data. The evidence points to a deliberate credential‑stealing operation targeting users of the Humanity Protocol platform, likely intended to harvest seed phrases or private keys.

Because the domain is already offline, immediate containment actions include adding the IP address 172.67.206.84 to network block lists, ensuring that URL filtering solutions deny any future resolution of testnet.humanitiy.xyz, and monitoring Cloudflare‑originating traffic for similar sub‑domains. Defenders should also flag any email or messenger communications referencing a "Login | Humanity Protocol" page as suspicious, and conduct user education to reinforce the official login endpoints of the Humanity Protocol project. Continued observation of newly registered domains sharing the "humanitiy.xyz" suffix is advised, as the low registrar trust scores suggest the registration may have been leveraged for rapid repurposing.